# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [code-projects Simple Laundry System Parameter delmemberinfo.php sql injection](https://agentprime.io/advisories/CVE-2026-5565.md) `CVE-2026-5565` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Simple Laundry System Parameter searchguest.php sql injection](https://agentprime.io/advisories/CVE-2026-5564.md) `CVE-2026-5564` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [AutohomeCorp frostmourne Alarm Preview previewData httpTest sql injection](https://agentprime.io/advisories/CVE-2026-5563.md) `CVE-2026-5563` · CVE record: AutohomeCorp frostmourne · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [provectus kafka-ui Endpoint testexecutions validateAccess code injection](https://agentprime.io/advisories/CVE-2026-5562.md) `CVE-2026-5562` · CVE record: provectus kafka-ui · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, Code injection - [Campcodes Complete POS Management and Inventory System Environment Variable SettingsController.php injection](https://agentprime.io/advisories/CVE-2026-5561.md) `CVE-2026-5561` · CVE record: Campcodes Complete POS Management and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, CWE-707 - [PHPGurukul Online Shopping Portal Project Parameter payment-method.php sql injection](https://agentprime.io/advisories/CVE-2026-5560.md) `CVE-2026-5560` · CVE record: PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul PHPGurukul Online Shopping Portal Project Parameter pending-orders.php sql injection](https://agentprime.io/advisories/CVE-2026-5558.md) `CVE-2026-5558` · CVE record: PHPGurukul PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [badlogic pi-mono loader.ts discoverAndLoadExtensions code injection](https://agentprime.io/advisories/CVE-2026-5556.md) `CVE-2026-5556` · CVE record: badlogic pi-mono · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, Code injection - [code-projects Concert Ticket Reservation System Parameter login.php sql injection](https://agentprime.io/advisories/CVE-2026-5555.md) `CVE-2026-5555` · CVE record: code-projects Concert Ticket Reservation System · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Concert Ticket Reservation System Parameter process_search.php sql injection](https://agentprime.io/advisories/CVE-2026-5554.md) `CVE-2026-5554` · CVE record: code-projects Concert Ticket Reservation System · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Cellphone System Parameter available.php sql injection](https://agentprime.io/advisories/CVE-2026-5553.md) `CVE-2026-5553` · CVE record: itsourcecode Online Cellphone System · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul Online Shopping Portal Project Parameter sub-category.php sql injection](https://agentprime.io/advisories/CVE-2026-5552.md) `CVE-2026-5552` · CVE record: PHPGurukul Online Shopping Portal Project · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Free Hotel Reservation System Parameter login.php sql injection](https://agentprime.io/advisories/CVE-2026-5551.md) `CVE-2026-5551` · CVE record: itsourcecode Free Hotel Reservation System · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [PHPGurukul User Registration & Login and User Management System yesterday-reg-users.php sql injection](https://agentprime.io/advisories/CVE-2026-5543.md) `CVE-2026-5543` · CVE record: PHPGurukul User Registration & Login and User Management System · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Simple Laundry System Parameter modifymember.php sql injection](https://agentprime.io/advisories/CVE-2026-5540.md) `CVE-2026-5540` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [halex CourseSEL HTTP GET Parameter IndexController.class.php check_sel sql injection](https://agentprime.io/advisories/CVE-2026-5537.md) `CVE-2026-5537` · CVE record: halex CourseSEL · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [itsourcecode Online Enrollment System Parameter index.php sql injection](https://agentprime.io/advisories/CVE-2026-5534.md) `CVE-2026-5534` · CVE record: itsourcecode Online Enrollment System · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, SQL injection - [Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows](https://agentprime.io/advisories/GHSA-mwmh-mq4g-g6gr.md) `GHSA-mwmh-mq4g-g6gr`, `CVE-2026-34773` · npm `electron`: affected `<38.8.6 || >=39.0.0-alpha.1, <39.8.1 || >=40.0.0-alpha.1, <40.8.1 || >=41.0.0-alpha.1, <41.0.0`, fixed in `38.8.6`, `39.8.1`, `40.8.1`, `41.0.0` · CVSS 4.7 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Other injection, CWE-20 - [Electron: HTTP Response Header Injection in custom protocol handlers and webRequest](https://agentprime.io/advisories/GHSA-4p4r-m79c-wq3v.md) `GHSA-4p4r-m79c-wq3v`, `CVE-2026-34767` · npm `electron`: affected `<38.8.6 || >=39.0.0-alpha.1, <39.8.3 || >=40.0.0-alpha.1, <40.8.3 || >=41.0.0-alpha.1, <41.0.3`, fixed in `38.8.6`, `39.8.3`, `40.8.3`, `41.0.3` · CVSS 5.9 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Other injection - [Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values](https://agentprime.io/advisories/GHSA-rx22-g9mx-qrhv.md) `GHSA-rx22-g9mx-qrhv`, `CVE-2026-26962` · RubyGems `rack`: affected `>=3.2.0, <3.2.6`, fixed in `3.2.6` · CVSS 4.8 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Other injection - [projectworlds Car Rental Project Parameter login.php sql injection](https://agentprime.io/advisories/CVE-2026-5368.md) `CVE-2026-5368` · CVE record: projectworlds Car Rental Project · CVSS 6.9 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Other injection, SQL injection - [Tenda G103 Setting gpon.lua action_set_net_settings command injection](https://agentprime.io/advisories/CVE-2026-5339.md) `CVE-2026-5339` · CVE record: Tenda G103 · CVSS 5.1 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Other injection, Command injection - [Tenda G103 Setting system.lua action_set_system_settings command injection](https://agentprime.io/advisories/CVE-2026-5338.md) `CVE-2026-5338` · CVE record: Tenda G103 · CVSS 5.1 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Other injection, Command injection - [itsourcecode Online Enrollment System Parameter index.php sql injection](https://agentprime.io/advisories/CVE-2026-5334.md) `CVE-2026-5334` · CVE record: itsourcecode Online Enrollment System · CVSS 6.9 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Other injection, SQL injection - [DefaultFuction Content-Management-System tools.php command injection](https://agentprime.io/advisories/CVE-2026-5333.md) `CVE-2026-5333` · CVE record: DefaultFuction Content-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Other injection, Command injection - [fast-filesystem-mcp is vulnerable to command injection through handleGetDiskUsage function](https://agentprime.io/advisories/GHSA-5226-3rvg-hp4x.md) `GHSA-5226-3rvg-hp4x`, `CVE-2026-5327` · npm `fast-filesystem-mcp`: affected `<=3.5.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Other injection, Command injection - [shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection](https://agentprime.io/advisories/CVE-2026-5328.md) `CVE-2026-5328` · CVE record: shsuishang modulithshop · CVSS 5.3 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Other injection, SQL injection - [PGP Decryption Sender LDAP Injection](https://agentprime.io/advisories/CVE-2026-29138.md) `CVE-2026-29138` · CVE record: SEPPmail Secure Email Gateway · CVSS 6.3 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Other injection - [PGP Decryption Recipient LDAP Injection](https://agentprime.io/advisories/CVE-2026-29131.md) `CVE-2026-29131` · CVE record: SEPPmail Secure Email Gateway · CVSS 4.9 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Other injection - [AlejandroArciniegas mcp-data-vis MCP server.js request sql injection](https://agentprime.io/advisories/CVE-2026-5322.md) `CVE-2026-5322` · CVE record: AlejandroArciniegas mcp-data-vis · CVSS 6.9 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Other injection, SQL injection - [phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and \_ Metacharacters Enable Broad Content Disclosure](https://agentprime.io/advisories/GHSA-gcp9-5jc8-976x.md) `GHSA-gcp9-5jc8-976x`, `CVE-2026-34973`, `PKSA-fk9h-qz7y-fk1q` · Packagist `thorsten/phpmyfaq`: affected `<4.1.1`, fixed in `4.1.1` · CVSS 6.9 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Other injection - [ewe Has Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting)](https://agentprime.io/advisories/GHSA-x2w3-23jr-hrpf.md) `GHSA-x2w3-23jr-hrpf`, `CVE-2026-34715` · Hex `ewe`: affected `<3.0.6`, fixed in `3.0.6` · CVSS 5.3 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Other injection - [AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass](https://agentprime.io/advisories/GHSA-63hf-3vf5-4wqf.md) `GHSA-63hf-3vf5-4wqf`, `CVE-2026-34520`, `PYSEC-2026-2102` · PyPI `aiohttp`: affected `<3.13.4`, fixed in `3.13.4` · CVSS 2.7 Low · Not analysed yet · Published 1 Apr 2026 · Tags: Other injection - [AIOHTTP has HTTP response splitting via \r in reason phrase](https://agentprime.io/advisories/GHSA-mwh4-6h8g-pg8w.md) `GHSA-mwh4-6h8g-pg8w`, `CVE-2026-34519`, `PYSEC-2026-2101` · PyPI `aiohttp`: affected `<3.13.4`, fixed in `3.13.4` · CVSS 2.7 Low · Not analysed yet · Published 1 Apr 2026 · Tags: Other injection - [AIOHTTP has CRLF injection through multipart part content type header construction](https://agentprime.io/advisories/GHSA-2vrm-gr82-f7m5.md) `GHSA-2vrm-gr82-f7m5`, `CVE-2026-34514`, `PYSEC-2026-2096` · PyPI `aiohttp`: affected `<3.13.4`, fixed in `3.13.4` · CVSS 2.7 Low · Not analysed yet · Published 1 Apr 2026 · Tags: Other injection - [code-projects Simple Laundry System Parameter delstaffinfo.php sql injection](https://agentprime.io/advisories/CVE-2026-5257.md) `CVE-2026-5257` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Other injection, SQL injection - [code-projects Simple Laundry System Parameter modify.php sql injection](https://agentprime.io/advisories/CVE-2026-5256.md) `CVE-2026-5256` · CVE record: code-projects Simple Laundry System · CVSS 6.9 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Other injection, SQL injection - [xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion](https://agentprime.io/advisories/GHSA-wh4c-j3r5-mjhp.md) `GHSA-wh4c-j3r5-mjhp`, `CVE-2026-34601` · npm `xmldom` and 1 more: affected `<=0.6.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 1 Apr 2026 · Tags: Other injection - [itsourcecode Payroll Management System Parameter view_employee.php sql injection](https://agentprime.io/advisories/CVE-2026-5238.md) `CVE-2026-5238` · CVE record: itsourcecode Payroll Management System · CVSS 6.9 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, SQL injection - [itsourcecode Payroll Management System Parameter manage_user.php sql injection](https://agentprime.io/advisories/CVE-2026-5237.md) `CVE-2026-5237` · CVE record: itsourcecode Payroll Management System · CVSS 6.9 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Simple Gym Management System Payment sql injection](https://agentprime.io/advisories/CVE-2026-5206.md) `CVE-2026-5206` · CVE record: code-projects Simple Gym Management System · CVSS 5.3 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Student Membership System Admin Login index.php sql injection](https://agentprime.io/advisories/CVE-2026-5198.md) `CVE-2026-5198` · CVE record: code-projects Student Membership System · CVSS 6.9 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Student Membership System delete_user.php sql injection](https://agentprime.io/advisories/CVE-2026-5197.md) `CVE-2026-5197` · CVE record: code-projects Student Membership System · CVSS 5.3 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Student Membership System delete_member.php sql injection](https://agentprime.io/advisories/CVE-2026-5196.md) `CVE-2026-5196` · CVE record: code-projects Student Membership System · CVSS 5.3 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, SQL injection - [code-projects Student Membership System User Registration sql injection](https://agentprime.io/advisories/CVE-2026-5195.md) `CVE-2026-5195` · CVE record: code-projects Student Membership System · CVSS 6.9 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, SQL injection - [TRENDnet TEW-713RE setSysAdm command injection](https://agentprime.io/advisories/CVE-2026-5184.md) `CVE-2026-5184` · CVE record: TRENDnet TEW-713RE · CVSS 5.3 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, Command injection - [TRENDnet TEW-713RE addRouting sub_421494 command injection](https://agentprime.io/advisories/CVE-2026-5183.md) `CVE-2026-5183` · CVE record: TRENDnet TEW-713RE · CVSS 5.3 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, Command injection - [SourceCodester Teacher Record System Parameter sql injection](https://agentprime.io/advisories/CVE-2026-5182.md) `CVE-2026-5182` · CVE record: SourceCodester Teacher Record System · CVSS 6.9 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple Doctors Appointment System ajax.php sql injection](https://agentprime.io/advisories/CVE-2026-5180.md) `CVE-2026-5180` · CVE record: SourceCodester Simple Doctors Appointment System · CVSS 6.9 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, SQL injection - [SourceCodester Simple Doctors Appointment System login.php sql injection](https://agentprime.io/advisories/CVE-2026-5179.md) `CVE-2026-5179` · CVE record: SourceCodester Simple Doctors Appointment System · CVSS 6.9 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, SQL injection - [Totolink A3300R cstecgi.cgi setIptvCfg command injection](https://agentprime.io/advisories/CVE-2026-5178.md) `CVE-2026-5178` · CVE record: Totolink A3300R · CVSS 5.3 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, Command injection - [Totolink A3300R cstecgi.cgi setWiFiBasicCfg command injection](https://agentprime.io/advisories/CVE-2026-5177.md) `CVE-2026-5177` · CVE record: Totolink A3300R · CVSS 5.3 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, Command injection - [Totolink A3300R cstecgi.cgi setSyslogCfg command injection](https://agentprime.io/advisories/CVE-2026-5176.md) `CVE-2026-5176` · CVE record: Totolink A3300R · CVSS 6.9 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Other injection, Command injection - [Tenda CH22 WriteFacMac FormWriteFacMac command injection](https://agentprime.io/advisories/CVE-2026-5153.md) `CVE-2026-5153` · CVE record: Tenda CH22 · CVSS 5.3 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: Other injection, Command injection - [code-projects Accounting System Parameter viewin_costumer.php sql injection](https://agentprime.io/advisories/CVE-2026-5150.md) `CVE-2026-5150` · CVE record: code-projects Accounting System · CVSS 6.9 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: Other injection, SQL injection - [YunaiV yudao-cloud page sql injection](https://agentprime.io/advisories/CVE-2026-5148.md) `CVE-2026-5148` · CVE record: YunaiV yudao-cloud · CVSS 5.1 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: Other injection, SQL injection - [YunaiV yudao-cloud get-by-website sql injection](https://agentprime.io/advisories/CVE-2026-5147.md) `CVE-2026-5147` · CVE record: YunaiV yudao-cloud · CVSS 6.9 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: Other injection, SQL injection - [Totolink A3300R Parameter cstecgi.cgi setVpnPassCfg command injection](https://agentprime.io/advisories/CVE-2026-5105.md) `CVE-2026-5105` · CVE record: Totolink A3300R · CVSS 5.3 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: Other injection, Command injection - [Totolink A3300R cstecgi.cgi setStaticRoute command injection](https://agentprime.io/advisories/CVE-2026-5104.md) `CVE-2026-5104` · CVE record: Totolink A3300R · CVSS 5.3 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: Other injection, Command injection - [Totolink A3300R cstecgi.cgi setUPnPCfg command injection](https://agentprime.io/advisories/CVE-2026-5103.md) `CVE-2026-5103` · CVE record: Totolink A3300R · CVSS 5.3 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: Other injection, Command injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .